Meeting Notes - 2026-08-13

Attendees

• Alex Olivier
• Omri
• Dave Hyland
• Karl
• Roland
• Vladi
• John Jiang
• Michiel Trimpe
• Edmund

Agenda

• Draft updates

  • Omri

    • AuthZEN Profile for OAuth 2.0 Token Issuance
    • AuthZEN Binding for OAuth 2.0 Token Exchange

  • Karl

    • AROP
    • ARAP

  • COAZ

    • Draft needs updating to latest MCP spec
    • Ref implementation https://github.com/alexolivier/authzen-coaz
    • Path to implementors draft
• WG Draft Process
  • Agreed: SOP: Bringing a New Draft into the OpenID AuthZEN Working Group
  • Proposed: SOP: Managing an Adopted Draft in the OpenID AuthZEN Working Group
• Certification

Notes

AuthZEN Profiles (Omri)

• Dec 2025 interop took first step with IdP using AuthZEN during token issuance
• Leading IdPs have a way to hook in
• Karl: Useful to split up workforce and customer identity systems. Workforce extensiblity is a risk. Customer side is designed to be programmatic.
• Need to acknowledge that developers think in tokens
• IETF drafts, but may not stay there as nothing changes in the OAuth spec - its about how an OAuth AS used OAuth.
• Split up into 3 drafts, issuance, exchange and claims
• Karl: This looks like the COAZ layer for OAuth? AlexO: COAZ-OAuth binding?
  • Its a mapping from the OAuth information model and the AuthZEN model.
• John: Where do the actions come from in the example?
  • These are scopes. The canonical mapping defines it.
• Roland: I like the general approach, mixing token type and scopes in the evaluations could be tricky?
  • Landed there to keep the decision critical feilds in the SAR and not fill context.
• Past RAR binding for AuthZEN wasn't the right model
• Karl: Make sure the OAuth hooks are in place and then have the AuthZEN bindings
• Dave: One exception is the OIDF grant management API - agents can start asking for entitlements.
• Karl: ID-JAG will drive the need for this to exist.
• Omri: Does the WG want to bring these drafts in (consenus on call is yes)

ARAP/AROP

• Going to restructure the docs a bit so need to land the open PR Link

COAZ

• Need

AOB

• Karl: Need to sure up the mechanism for extensiblity of obligations. Sent strawman to the mailing list. Formalizing the mechanism between the PDP/PEP. Link
  • Omri: Started developing the terminology - 1.0 is core, then there are things which are bigger than profiles. But some are things which are extensions.
  • Need to find a home for - Formalized extensibility model for AuthZEN - next meeting agenda